Connections
Connections is the dashboard section for the servers behind your workspaces: where you SSH to, how they are reachable, and a one-line installer that puts them on your private network.
Open it from the sidebar (Connections) at /dashboard/connections.
SSH access
An SSH access record is a server you reach over SSH: a workspace box, a customer's VPS, a machine at home.
- Name, host, port, username — what you would type after
ssh. - Authentication — SSH agent stores nothing: your own machine's keys authenticate. Password and Private key are stored encrypted on the T-Ex LLM server and never shown again.
- Reachable privately or publicly — a private host lives on your overlay network (Tailscale, NetBird, ZeroTier, WireGuard); its address on that network is what the SSH command uses. A public host has a routable address.
- T-Ex LLM machine — link the record to the machine the daemon registered from the same box.
Each card gives you Copy (the ssh command), Check (the T-Ex LLM server opens one TCP connection and reads the SSH banner), Install network, Edit and remove. A private host the API server itself cannot route to shows as unreachable even when you can reach it; the check is a sanity probe, not an auth test.
Install a private network
Click Install private network, pick a provider, paste an auth key if you have one, and click Generate command. You get a one-liner like:
curl -fsSL https://api.example.com/api/v1/public/network-installs/<token>/install.sh | sudo bashRun it in a terminal on the server. The script installs the client, joins your network, and reports back to the dashboard with the address it got. If the install was created for an SSH host, that host's network address is filled in automatically.
| Provider | What the script does | Secret |
|---|---|---|
| Tailscale | Official installer, then tailscale up with your options (node name, Headscale login server, tags, --accept-routes, --ssh). | Auth key, optional. Without one the script prints a login link. |
| NetBird | Official installer, then netbird up (setup key, self-hosted management URL, node name). | Setup key, optional. |
| ZeroTier | Official installer, then joins the network id. Authorise the node in your controller. | None. |
| WireGuard | Installs wireguard-tools, writes /etc/wireguard/<iface>.conf (mode 600), enables wg-quick@<iface>. | The wg-quick config, required. |
| Custom script | Runs the bash script you paste, as root. | The script, required. |
The command is shown once. The link stops working when the script reports back, when you cancel it, or when it expires (30 minutes to 24 hours, your choice). Only a hash of the token is stored; the auth key is stored encrypted and deleted after use.
Server settings (operators)
Two settings on the backend:
SECRETS_ENCRYPTION_KEY— any string. Without it the dashboard cannot store passwords, private keys or VPN auth keys (agent auth and key-less installs still work).PUBLIC_API_URL— the API's public origin, used in thecurlone-liner and the script's report-back URL. Leave it empty to derive it from the request (setX-Forwarded-Proto/X-Forwarded-Hoston your proxy).
The public endpoints (/api/v1/public/network-installs/<token>/install.sh and …/report) are unauthenticated by design and rate limited per client address (NETWORK_INSTALL_RATE_PER_MINUTE, NETWORK_INSTALL_BURST).